Member guide

Welcome aboard

You've been invited to the lab. These steps take you from an invite email to a working VPN and your first sign-in. Plan on about ten minutes, plus a phone for your authenticator app.

Before you start

Membership is invite-only: there's no sign-up form. If you haven't been invited, ask the person who runs the lab. Once you have been, gather:

  • The invite email from the lab's account system. It holds a one-time activation link and your username.
  • An authenticator app on your phone: any TOTP app works (Aegis, 2FAS, Google Authenticator, 1Password, Bitwarden…).
  • The device you want to connect first: laptop, desktop or phone.
The two places you'll use
NameWhat it's forWhere it works
Account portal
zitadel.prestonhager.com		Your password, second factor and profile. Every member app signs you in here.Anywhere
VPN portal
wg.prestonhager.com		Create, download and remove VPN configs for your devices.Home network or VPN only

Setup steps

  1. Activate your account

    Open the activation link in your invite email. It expires, so do this soon. You'll be asked to:

    1. Choose a strong, unique password. A password manager is the easy way.
    2. Set up your second factor: scan the QR code with your authenticator app and type in the 6-digit code it shows.
    3. Check your name and email. Email is used for password resets and notices.
    Link expired or never arrived?

    Check spam first, then ask the admin to resend the invite. Nobody will ever ask you for your password or codes, including the admin.

  2. Install WireGuard

    WireGuard is the VPN app. Install the official client for your device:

    Windows 10 / 11

    Download the installer from wireguard.com/install and run it. WireGuard lives in the system tray.

    macOS

    Install WireGuard from the Mac App Store (publisher: WireGuard Development Team). Allow it to add VPN configurations when macOS asks.

    Linux

    Install wireguard-tools from your distribution, or use NetworkManager's built-in WireGuard support:

    # Debian / Ubuntu
sudo apt install wireguard-tools
# Fedora
sudo dnf install wireguard-tools
# NixOS (temporary shell)
nix shell nixpkgs#wireguard-tools

    iPhone / iPad

    Install WireGuard from the App Store. You'll add a tunnel by scanning a QR code.

    Android

    Install WireGuard from Google Play or F-Droid. You'll add a tunnel by scanning a QR code.

  3. Get your first VPN config

    A VPN config is a small file (or QR code) that belongs to one device. How you get the first one depends on where you are:

    You are…Do this
    On the home networkOpen the VPN portal, choose Sign in and log in with your account. Create a new peer named after the device (for example alex-laptop), then download the config file or show its QR code.
    Anywhere elseThe VPN portal only answers from inside, so ask the admin for your first config. It'll come as a .conf file or QR code over a private channel. After that you can manage everything yourself.

    Don't see a button to create a peer? Your account may not have self-service turned on yet. Ask the admin.

  4. Import the config and connect

    • Desktop apps: Import tunnel(s) from file, pick the .conf, then Activate.
    • Phones: tap + → Scan from QR code, name it Homelab, then flip the switch on.
    • Linux CLI: sudo cp homelab.conf /etc/wireguard/, then sudo wg-quick up homelab.

    Check it works: with the tunnel on, open the VPN portal from a non-home network (phone on mobile data is a good test). If it loads instead of saying Forbidden, you're in. 🎉

    Only lab traffic goes through the tunnel

    Your normal browsing still uses your own connection, so you can leave the VPN on. Turn it on whenever you want to reach member-only services.

  5. Sign in to your services

    Every member app has a Sign in with SSO (or similar) button. It sends you to the account portal; use your username, password and authenticator code. Which apps you see depends on the groups the admin put you in. Not sure what you have? Ask.

    Member documentation lives at serverdocs and only loads over the VPN.

Adding more devices

Each device gets its own config. Never copy one config onto two devices: they'd fight over the same address and both drop off.

  1. Connect a device that's already set up, or be on the home network.
  2. Open the VPN portal and sign in.
  3. Create a peer for the new device, then download it or scan its QR code on that device.
  4. Delete peers for devices you no longer use, and immediately for a lost or stolen one.

Server access (advanced)

Only for members who've been given shell access. Server logins use short-lived SSH certificates from the lab's identity provider instead of passwords or long-lived keys, through opkssh. Your admin will give you the server names and add you to the right groups; full client setup is in the member docs (VPN required). The daily routine looks like:

opkssh login        # opens a browser: sign in + authenticator code
ssh you@server      # key is valid for about 12 hours
sudo -i             # prints a link and code: approve in the browser

Troubleshooting

What you seeTry this
Forbidden on a member pageThe VPN isn't on, or it's on but not handshaking. In the WireGuard app, check that latest handshake is recent. Toggle the tunnel off and on.
Tunnel on, but no handshakeSome guest and work Wi-Fi blocks VPNs. Try mobile data. Make sure the device's clock is correct.
Two devices keep droppingThey're sharing one config. Make a separate peer for each.
Authenticator code rejectedCodes are time-based: set your phone's clock to automatic and use the newest code.
Locked out after many triesBrute-force protection locks the account for a while. Wait, then try again, or ask the admin.
Lost your phone / authenticatorAsk the admin to reset your second factor. Expect a quick identity check first.
An app says you have no accessYou're signed in but not in that app's group. Ask the admin.

Staying safe

Do

  • Use a password manager and a unique password.
  • Keep the authenticator on a device with a screen lock.
  • Remove VPN peers for devices you've retired.
  • Report anything odd: unexpected prompts, sign-in emails you didn't trigger.

Don't

  • Share a VPN config, QR code or screenshot of either.
  • Approve a sign-in or sudo prompt you didn't start.
  • Post screenshots of internal pages publicly.
  • Give your password or codes to anyone, admin included.

FAQ

Does the VPN see my everyday browsing?

No. The tunnel only carries traffic headed for the lab. Everything else goes out your normal connection.

Can I use the lab without the VPN?

A few apps are public and only need your account. Admin tools, the VPN portal and member docs need the VPN, and that's on purpose.

Can I sign in with Google?

If the admin has turned it on, you can link a Google account whose email matches your lab account. You'll still be asked for your authenticator code.

How do I leave?

Tell the admin. Your account and VPN peers are removed together, and access ends quickly everywhere.